{"id":"CVE-2026-116613","kind":"vulnerability","aliases":["CVE-2026-116613"],"related":[],"title":"WordPress Animated Text Block plugin: shortcode leaks hidden post content","description":"The Animated Text Block plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.2.6 via the 'animated-text' shortcode. This is due to the atb_shortcode_handler() function fetching an arbitrary post by attacker-supplied ID and, in the 'publish' branch, calling displayContent() with no capability check and no validation that the post's post_type is the plugin's own CPT or is otherwise viewable (is_post_type_viewable()). This makes it possible for authenticated attackers, with Contributor-level access and above, to read the rendered block content of any published post, including posts of non-public custom post types (public=false, show_in_rest=false) that WordPress would otherwise hide from direct URLs and the REST API.","summary":"Versions up to and including 1.2.6 of the Animated Text Block plugin expose the 'animated-text' shortcode, which renders any published post by ID without checking permissions. An authenticated Contributor can read the content of posts that WordPress normally hides, including private custom post types.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugins"],"not_affected_if":["plugin-not-installed","plugin-version-above-1.2.6"],"how_to_check":"- Check the installed version of the Animated Text Block plugin in the WordPress admin plugins list, or with `wp plugin get animated-text-block --field=version` (slug unverified in sources)\n- Look for the 'animated-text' shortcode in posts that Contributors can edit","fix":"- Update the Animated Text Block plugin to a version later than `1.2.6` (exact fixed version unknown from sources)\n- If no fix is available, deactivate the plugin","status":"open","published_at":"2026-10-28T04:17:57+00:00","first_seen_at":"2026-10-28T04:30:58+00:00","triaged_at":"2026-10-28T04:32:03+00:00","updated_at":"2026-10-28T04:32:03+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T04:32:03Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Animated Text Block plugin to a version later than `1.2.6` (exact fixed version unknown from sources)\n- If no fix is available, deactivate the plugin","reach":"internet","title":"WordPress Animated Text Block plugin: shortcode leaks hidden post content","impact":"medium","summary":"Versions up to and including 1.2.6 of the Animated Text Block plugin expose the 'animated-text' shortcode, which renders any published post by ID without checking permissions. An authenticated Contributor can read the content of posts that WordPress normally hides, including private custom post types.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugins","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Contributor reads content of hidden or private posts","analyst_note":"Confirm the fixed version and the plugin slug on the WordPress.org plugin page or the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-116613.","how_to_check":"- Check the installed version of the Animated Text Block plugin in the WordPress admin plugins list, or with `wp plugin get animated-text-block --field=version` (slug unverified in sources)\n- Look for the 'animated-text' shortcode in posts that Contributors can edit","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-version-above-1.2.6"],"who_is_affected":"Sites running the Animated Text Block plugin at version 1.2.6 or earlier where Contributor-level or higher accounts exist, since those accounts can invoke the shortcode. Sites where untrusted users cannot create content, or that do not use the plugin, can skip it. unknown whether the issue depends on any non-default setting.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000675,"input_tokens":3476,"output_tokens":654,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116613':13A,16A '-2026':12A,15A '1.2.6':30B,90C 'access':160C 'anim':2A,33B,40B,72C,94C 'animated-text':39B,93C 'api':199C 'arbitrari':108C 'atb':102C 'attack':112C,155C 'attacker-suppli':111C 'authent':54B,154C 'block':4A,35B,74C,167C 'branch':119C 'call':120C 'capabl':124C 'check':51B,125C 'content':10A,59B,168C 'contributor':55B,158C 'contributor-level':157C 'cpt':140C 'custom':68B,179C 'cve':11A,14A 'direct':194C 'displaycont':121C 'due':99C 'expos':37B 'exposur':83C 'fals':183C,187C 'fetch':106C 'function':105C 'handler':104C 'hidden':8A 'hide':65B,192C 'host':20B 'id':49B,114C 'includ':29B,66B,89C,173C 'inform':82C 'leak':7A 'level':159C 'make':150C 'non':177C 'non-publ':176C 'normal':64B 'otherwis':143C,191C 'packag':17B 'permiss':52B 'plugin':5A,24B,36B,75C,137C 'possibl':152C 'post':9A,47B,61B,69B,109C,131C,133C,146C,172C,174C,180C 'privat':67B 'public':178C,182C 'publish':46B,118C,171C 'read':57B,164C 'render':44B,166C 'rest':186C,198C 'self':19B 'self-host':18B 'sensit':81C 'shortcod':6A,42B,96C,103C 'show':184C 'suppli':113C 'text':3A,34B,41B,73C,95C 'type':70B,134C,147C,181C 'url':195C 'valid':128C 'version':25B,85C 'via':91C 'viewabl':144C,148C 'vulner':79C 'without':50B 'wordpress':1A,21B,23B,63B,77C,189C 'wordpress-plugin':22B 'would':190C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Animated Text Block plugin at version 1.2.6 or earlier where Contributor-level or higher accounts exist, since those accounts can invoke the shortcode. Sites where untrusted users cannot create content, or that do not use the plugin, can skip it. unknown whether the issue depends on any non-default setting.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T04:17:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116613","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116613","severity":null,"published_at":"2026-10-28T04:17:57+00:00","modified_at":"2026-10-28T04:17:57+00:00","first_seen_at":"2026-10-28T04:30:58+00:00","fetched_at":"2026-10-28T04:30:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}